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antivirus A program that attempts to recognize, prevent, and remove computer viruses 
and other malicious software from the computer. 


archive A place or collection containing records, documents, or other materials of histori- 
cal interest. 


auditing Checking a computer system to verify intended programs and reliable data and 
to see whether the data is corrupted or displaying inaccurate results. 


B 


backdoor A gap in the security of a computer system that’s purposely left open to permit 
access. Hackers may create backdoors to a system once it has been compromised. 


banner grabbing A technique that enables a hacker to identify the type of operating 
system or application running on a target server. A specific request for the banner is often 
allowed through firewalls because it uses legitimate connection requests such as Telnet. 


black hat A malicious hacker. 
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black-box testing Testing a system or network without any knowledge of the internal 
structure. 


buffer A portion of memory available to store data. 


buffer overflow A situation where a program writes data beyond the buffer space allocated 
in memory. This can result in other valid memory being overwritten. Buffer overflows can 
occur as a consequence of bugs, improper configuration, and lack of bounds checking when 
receiving program input. 


bug A software or hardware error that triggers the malfunction of a particular program. 


C 


cache A fast storage buffer, such as that found directly on the central processing unit of a 
computer. 


calling procedure A software routine that passes control to a different software routine. 
When these routines exist on separate computers, the systems often use Remote Procedure 
Call (RPC) libraries. Also refers to function calls and subroutines. 


certificate authority (CA) The organization or program that issues digital certificates. 
client A system or software process that accesses a remote service on another computer. 


Common Internet File System/Server Message Block The standard for file sharing 
used with Microsoft Windows and IBM OS/2 operating systems. 


countermeasure An action taken to offset another action. Usually a fix for a vulnerabil- 
ity in a system. 


covert channel A channel that transfers communication in a nonstandard way, often 
such that it can’t be easily detected. Too frequently, this form of communication violates the 
security policy by using a channel in an unintended manner. 


cross-site scripting A computer security exploit that is used to execute a malicious script. 


D 


daemon A background program that resides on a computer and services requests. 
database A collection of data or information that’s organized for easy access and analysis. 
decryption The process of converting encrypted data to plain text. 


demilitarized zone (DMZ) A network area that sits between an organization’s internal 
network and an external network, usually the Internet. Most publicly available servers, 
such as web and FTP servers, reside in the DMZ. 
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digital certificate Credentials that contain personal information such as a name, a public 
key, an expiration date, and the digital signature of the certificate authority that issued the 
certificate. 


digital signature A hash of a message that has been encrypted with an individual’s private 
key. It serves as validation of a message’s authenticity. 


DNS enumeration Locating DNS records from a DNS server. 
domain name A unique name that identifies a company or organization on the Internet. 


Domain Name System (DNS) The name resolution system that translates alphabetic 
domain names into numeric IP addresses. 


E 


encryption The process of encoding information in an attempt to make it secure from 
unauthorized access. 


enumeration The creation of a list or inventory of items. 


Ethernet A frame-based computer networking technology for LANs. It defines wiring 
and signaling for the physical layer, frame formats, and protocols for the media access con- 
trol (MAC) and data link layer of the OSI model. 


exploit A defined procedure or program that takes advantage of a security hole in a com- 
puter program. 


Extended Stack Pointer (ESP) A location identifier used to access parameters passed into 
a subroutine as arguments. 


E 


Fiber Distributed Data Interface (FDDI) A standard for data transmission in a LAN. 


File Allocation Table (FAT) A file system used in DOS, Windows, and OS/2. It keeps 
track of where data is stored on disk. 


firewalking A method to collect information about a remote network protected by a firewall. 
Firewalking uses trace route-like IP packet analysis to determine whether a data packet can 
pass through the packet-filtering device/firewall from the attacker’s host to the victim’s host. 


firewall Rules created to enforce an access control list (ACL) and designed to prevent 
unauthorized access to or from a private network. 


footprinting Gathering information about a target to identify weaknesses. 
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fragmentation The means of breaking a larger message into smaller chunks for the pur- 
pose of sending or storing the data more efficiently. 


FreeBSD A free, open source operating system based on Unix. 


File Transfer Protocol SSL A secure form of FTP software in which Secure Sockets 
Layer/Transport Layer Security (SSL/TLS) protocols are used to secure the control and 
data connections. 


G 


gateway Software or hardware capable of decision making, which permits or denies 
access based on general rules. Firewalls are Layer 3 and Layer 4 gateways. 


GET An HTTP command used to request a file from a web server. 


gray hat A hacker who uses skills for defensive or offensive purposes as necessary. 


H 


hacktivism Hacking for a cause—for example, hacking to take down a child pornog- 
raphy site. 


hash A function that transforms a string of characters into a number known as the 
message digest. 


Hierarchical File System (HFS) A file system used in Mac OS X. It stores data in a top- 
to-bottom organization structure. 


honeynet An entire virtual network that is presented as a large honeypot. 


honeypot A system that is designed to attract probes, attacks, and potential exploits. 
Because honeypots attract attacks, they can be a liability. However, by having honeypots 
on the network, you can gain enormous amounts of information about how a malicious 
hacker, or even a script kiddie, gains access to systems. This information can lead to secu- 
rity improvements and/or help a security professional track down a hacker. 


hybrid attack A password attack that combines features of a brute-force attack with a 
dictionary attack. Characteristics of a hybrid attack include using dictionary terms that 
substitute numbers or special characters for letters or append numbers to words. 


Hypertext Transfer Protocol (HTTP) A communication protocol that facilitates browsing 
the World Wide Web. 


Hypertext Transport Protocol Secure (HTTPS) A secure version of the HTTP protocol 
used to access secure web servers. 


368 Glossary 


Institute of Electrical and Electronics Engineers (IEEE) An organization (sometimes 
referred to as the I Triple E) that creates standards that assist with the advancement of society’s 
use of technology. It includes engineers, scientists, and students. 


Internet Control Message Protocol (ICMP) An encapsulated IP packet that is used to 
send error and control messages. The ping command uses ICMP Echo requests and ICMP 
Echo responses to verify connectivity. 


Internet Protocol Security Architecture (IPSec) A Layer 3 protocol that provides secure 
tunneled communication with authentication and encryption over the Internet. It’s often 
used to create a virtual private network (VPN). 


intrusion detection system (IDS) A mechanism to monitor packets passing through com- 
puter networks. The IDS can be monitored as a security check on all transactions that take 
place in and out of a system. 


iris scanner A biometric device containing a small camera that examines the iris of the 
eye for purposes of authentication. 


K 


Kerberos A computer network authentication protocol. 


keylogger A software or hardware device that records information typed by users. Data is 
saved in a log file, which could be retrieved by a hacker. 


L 


Lightweight Directory Access Protocol (LDAP) A protocol used to access simple direc- 
tory structures. 


local area network (LAN) A network made up of system nodes and peripherals within a 
small geographical area. 


logic bomb A program with a delayed payload that is released only when certain condi- 
tions are met in the system or program environment. 


M 


malicious Deliberately harmful. 


mantrap A secured entrance, normally reserved for high-security facilities. The trap usu- 
ally involves a series of doors that someone must pass through and in which a trespasser 
could be detained by locking the doors. 
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Multipurpose Internet Mail Extensions (MIME) A communication protocol that allows 
for the transmission of data in many forms, such as audio, binary, or video, in email messages. 


N 


NetBSD The first freely redistributable, open source version of the BSD Unix operating 
system. 


Network Address Translation (NAT) A technique of mapping multiple IP addresses to a 
single external IP address belonging to the NAT device. This method is frequently used to 
connect multiple computers to the Internet. 


Network Basic Input/Output System (NetBIOS) An interface that provides communica- 
tion between a PC and the network. It was created by IBM and adopted by Microsoft. Net- 
BIOS includes a name service, a session service, and a datagram service. 


network interface card (NIC) A Layer 1 and Layer 2 device that provides upper-layer 
communication to a physical medium or medium type. Also known as a network adapter. 


network scanning Enumerating the available live hosts or IP addresses on a network. 


NOP Acommand that tells the processor to do nothing. Almost all processors have a 
NOP instruction that performs a null operation. In the Intel architecture, the NOP instruc- 
tion is one byte long and translates to 0x90 in machine code. A long run of NOP instruc- 
tions is called a NOP slide or sled. The CPU does nothing until it gets back to the main 
event (which precedes the return pointer). 


NT LAN Manager (NTLM) A challenge/response authentication protocol used in a variety 
of Microsoft network protocols for authentication purposes. 


null session An unauthenticated connection to a network share by an anonymous user on 
an unidentified system. 


O 


Open Systems Interconnection (OSI) A standard created by the International Organiza- 
tion for Standards (ISO) that describes seven layers with distinct responsibilities in moving 
data as it’s exchanged between two networked devices. 


OpenBSD An open source Unix-based operating system that has many available security 
measures. 


overt channel An obvious and defined communication path within a computer system or 
network, used for the transfer of data. 
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P 


passive attack An attack that violates the security of a system without directly interact- 
ing with the system. 


password cracker A program designed to decode passwords. 
patch A short set of instructions to correct a vulnerability in a computer program. 


personal identification number (PIN) An alphanumeric value often used as a secondary 
form of identification when using two-form authentication. 


phraselist A list of passphrases that a password-cracking tool uses to attempt to crack a 
password. 


physical security Nondigital methods and mechanisms in place to prevent attackers from 
getting access to a facility, resource, or information stored on physical media. It can be as 
simple as a locked door or as elaborate as multiple security layers, including armed guards. 


ping A common connection verification tool that uses ICMP messages to test a target’s 
response. It’s been nicknamed the Packet InterNet Groper. 


ping sweep A scan ofa range of IP addresses that shows which IP addresses are in 
use and which aren’t. Ping sweeps may include retrieving the DNS name for each live 
IP address. 


Point-to-Point Protocol (PPP) A protocol used for transporting IP packets over a serial 
link between the user and ISP. 


policy A set of rules and regulations specified by an organization as a basis for behavior, 
operation, or performance. 


port scanning Trying to identify the services running on a system by probing ports and 
viewing the responses from the system. This technique can be used to find services that 
indicate a weakness in the computer or network device. 


POST An HTTP command used to send text to a web server for processing. 


Post Office Protocol 3 (POP3) A standard interface for retrieving mail by an email client 
program and from an email server. 


Pretty Good Privacy (PGP) A software package that provides cryptographic routines for 
email and file-storage applications. 


private key Half of the formula to perform public key cryptography. It’s used to create 
a digital signature and to decrypt data that has been encrypted with the corresponding 
public key. 


probing Investigating or examining thoroughly. 
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process An entity that is uniquely identifiable as it executes in memory. 


protocol A convention or standard that controls and enables communications, connec- 
tions, and data transfers. 


proxy server A system that acts on behalf of other systems. Proxy servers are often focal 
points of a network and may contain firewalls. 


public key Half of the formula to perform public key cryptography. Messages that have 
been encrypted with someone’s public key can only be decrypted by the person’s private key. 


R 


remote access A communication method that allows access to a system or network from 
a remote location via a telephone line or the Internet. 


Request for Comments (RFC) A solicitation for professional discussion on a topic of 
interest. RFCs are often released when developing standards for protocols, systems, or 
procedures used by the Internet community. 


rootkit A collection of tools utilized by an intruder after gaining access to a computer 
system. These tools assist the attackers in any number of malicious purposes. Rootkits have 
been developed for all common operating systems, including Linux, Solaris, and Windows, 
as well as network-connected gaming systems. 


S 


script A text file containing ordered commands that a user can perform interactively at 
the keyboard. 


Secure Hash Algorithm (SHA) A cryptographic message digest algorithm, similar to the 
message digest family of hash functions developed by Ron Rivest. 


Secure Shell (SSH) Software that produces a secure logon for Windows and Unix using 
Layer 7 of the OSI model. 


Security Accounts Manager (SAM) A database of usernames, passwords, and permis- 
sions in the Windows architecture. 


security token A small physical device used in multifactor authentication that can store 
cryptographic keys and /or biometric data for identity verification. 


Sendmail An SMTP implementation used in Unix. 
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Serial Line IP (SLIP) A communications protocol for dial-up access to TCP/IP networks. 
It’s commonly used to gain access to the Internet as well as to provide dial-up access 
between LANs. 


server A computer system in a network that provides services to client applications and/or 
computers. 


Server Message Block (SMB) A protocol for sharing files, printers, serial ports, and 
communications abstractions such as named pipes and mail slots between computers. 


session An active communication between a user and the system or between two comput- 
ers. It also refers to Layer 5 (the session layer) of the OSI model. 


sheep dip A stand-alone computer that houses antivirus software and is used under 
strictly controlled norms to check all media devices before they’re connected to a network. 


shell A command language interpreter that is an interface between an operating system 
kernel and a user. 


shellcode Assembler code that can interact with the operating system and then exit. 
Hackers often use shellcode to launch exploits, such as stack-based overflows. 


shredding The physical destruction of the platters of a hard disk to ensure that the con- 
tents can never be recovered. 


Simple Mail Transfer Protocol (SMTP) A network protocol used when sending email. 


Simple Network Management Protocol (SNMP) An application layer protocol that 
facilitates the set and/or read management information in the Management Information 
Base (MIB) of a network device. 


Simple Object Access Protocol (SOAP) A protocol for exchanging XML-based messages 
using HTTP or SMTP as the transport. 


smartcard A device with an embedded microprocessor and storage space, often used 
with an access code to permit certificate-based authentication. 


social engineering The art of exploiting weaknesses common in human nature to trick a 
person into revealing useful information such as a user ID, password, or other confidential 
information. 


spyware Malicious software intended to intervene in or monitor the use of a computer 
without the user’s permission. Spyware doesn’t self-replicate like worms and Trojans. 


steganography The practice of hiding a message within an image, audio, or video file. It’s 
a form of a covert channel. 


System Integrity Verifier (SIV) A program that monitors system file hashes to determine 
whether a file has been changed, such as if an intruder altered or overwrote a system file. 
Tripwire is one of the most popular SIVs. 
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T 


TCP/IP The protocol suite of definitions for communications at Layers 3 and 4 of the OSI 
model. TCP/IP is the standard communication method that computers use to communicate 
over the Internet. 


Telnet An application used to create a remote session with a computer. 


Temporal Key Integrity Protocol (TKIP) An encryption standard defined in IEEE 802.11i 
and WPA for Wi-Fi networks designed to replace WEP. TKIP was structured to replace 
WEP with a more secure solution without replacing legacy hardware. 


third party A person, group, or business indirectly involved in a transaction or other rela- 
tionship between principals. 


threat An intentional or unintentional action that has the capability of causing harm to 
an information system. 


time bomb A type of logic bomb, with a delayed payload that is triggered by reaching 
some preset time, either once or periodically. 


time to live (TTL) A field in the IP header that indicates the amount of time a transmitted 
packet will be valid. The TTL defines how many router hops a packet can make before it 
must be discarded. If a packet is discarded by a router, an ICMP error message is generated 
to the sender. 


timestamp A number that represents the date and time. Recording timestamps is impor- 
tant for tracking events as they occur on a computer. 


traceroute A tool to trace a path to a destination system. 
traffic The data being transferred across the network media. 


Trojan A program that seems to be useful or harmless but in fact contains hidden code 
embedded to take advantage of or damage the computer on which it’s run. 


tunneling Encapsulating one protocol or session inside the data structure of another 
protocol. 


tunneling virus A virus that attempts to tunnel underneath antivirus software so that it’s 
not detected. 


U 


Uniform Resource Locator (URL) The address that defines the route to a file on a web 
server (HTTP server). 


User Datagram Protocol (UDP) The connectionless, unreliable Internet protocol that 
functions at Layer 4 of the OSI model. 
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V 


virus Malicious code written with an intention to damage the user’s computer. Viruses are 
parasitic and attach to other files or boot sectors. They need the movement of a file to infect 
other computers. 


virus hoax A bluff in the name of a virus. Creators attempt to arouse fear, and sometimes 
encourage the removal of system files. 


virus signature A unique string of bits that forms a recognizable binary pattern. This pat- 
tern is a fingerprint that can be used to detect and eradicate viruses. 


vulnerability A bug or glitch in computer software, an operating system, or architecture 
that can be exploited, leading to a system compromise. 


vulnerability scanning Searching for devices, processes, or configurations on your net- 
work that have known vulnerabilities. 


W 


war dialer A malicious application that randomly calls phone numbers while trying to 
detect the response of a computer modem. 


warchalking A technique to identify key features of Wi-Fi networks for others by drawing 
symbols in public places (where anyone can intrude easily) and encourage open access. 


web server The computer that delivers web pages to browsers and other files to applica- 
tions via the HTTP protocol. 


web spider Scanning web sites for certain information such as email accounts. 


white-box testing Testing software, a system, or a network with knowledge of the inter- 
nal structure. Also called glass box testing. 


Wi-Fi A certification from the Wi-Fi alliance to promote interoperability of wireless equip- 
ment for 802.11 networks (including 802.11a, 802.11b, 802.11g, and 802.11n). This term 
was popularized by the Wi-Fi Alliance. 


Wired Equivalent Privacy (WEP) A technically obsolete protocol for wireless local area 
networks (WLAN). WEP was proposed to present a level of security similar to that of a 
wired LAN. 


wiretapping A process by which a third party intervenes in a telephone conversation, usu- 
ally through a secret medium. 


worm A malicious software application that is structured to spread through computer 
networks. These applications are self-propagating. 
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daemons, 177 
data extraction in SQL injection, 225 
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administrator passwords and 

usernames, 252 

Linux systems, 293 

port numbers, 127 
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denial-of-service (DoS) attacks, 173 

countermeasures, 182 

description, 5 

distributed, 177-179, 178-180 

exam essentials, 188 

NetBIOS, 107 

overview, 174-177 

review questions, 189-194 

Smurf and SYN floods, 180-181, 181 

SQL injection, 225 

summary, 187 

Trojans, 130 

wireless, 251 
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DEPLOY.EXE program, 112 
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fast infectors, 142 
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goals, hacker, 5-6 
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for information gathering, 39-40 
Google Groups, 37 
Government Paperwork Elimination Act 
(GPEA), 22 
Graffiti game, 135 
graphic images as hiding places, 115-116 
gray-box testing, 13 
gray hats, 3-5 
Group Policy security, 85 
guessing passwords, 98-99 
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